Byung-Hee HWANG wrote: > hi, > > On Sun, 2007-11-11 at 04:56 -0800, SpankTheSpam wrote: > >> Hi >> >> I have installed URICountry plugin along with p5-Mail-SpamAssassin-3.2.3 and >> amavisd-new-2.5.2,1 and have added few rules, and one to test it in my >> local.cf: >> > [...] > > well, imho, its using is not fair to over the world. because there > regarding spam country may/might be a little bit pure email users. we > can use another way instead of the dangerous way. i would like to here > some opinion about that.. > >
Uricountry, relaycountry, etc are all quite useful, but I agree their use must be reasonably tempered. I strongly disagree with using either of these systems to assign more than half your spam threshold to any message. Country of origin or hosting site alone is not a very good sole criteria for declaring a message to be spam. However, in my case I do receive a few nonspam messages from Korea each year, like this message for example, and all are quite clearly nonspam and technical in nature... I also receive around a thousand spam messages that were sent from infected hosts in Korea each year (mostly controlled by American spammers). As a result, I assign 1.5 points (of a 5.0 threshold) to messages delivered to my network from Korea. This helps catch some of the more evasive spam, but I also have yet to have it cause a single false positive on a nonspam message. (Your message would have totaled 1.5/5.0 if it was sent directly, as it caught no other positive scoring rules) This is even more true for web hosting. There's no reason an american company can't have a website hosted overseas. So many of their products are made there, so why shouldn't the websites be hosted there? Unfortunately, like any rule, there's a lot of admins out there who think in absolutes, and assign absurd scores to rules. This is, of course, highly contrary to the whole design of SpamAssassin, which exists because Justin got tired of single-criteria decisions for spam causing false positives. I guess there's a human tendency to see a high probability and treat that as proof positive. (We all like to over-simplify things). I guess I failed to point out to "spankthespam" that using a 54 point score on a rule is quite unwise.
